fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout and each
recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on
Etherscan", now gate those requests. Both are off in a new install and offered
unticked on Welcome and in Settings. While one is off, the screens that relied
on it say so in a plain line. Each gated request reads its setting from storage
before it asks and when the answer lands, and drops a late answer. An open popup
takes another page's change and draws its screens again. While "Use Blockscout"
is off, no address keeps an untracked token, and no screen names a token from
Blockscout's report. ENS lookups ask only the RPC endpoint.

Model: opus-5-5

README.md

@@ -2836,9 +2836,10 @@ settings:
 Both settings are on the Welcome screen and in Settings. Both are off in a new
 install. Each setting applies to every network.
 
-Before each of these requests, the wallet reads its setting from storage. The
-wallet reads the setting again when the answer lands. While the setting is off,
-nothing is asked, and an answer that lands is dropped.
+Before each request that sends the user's data to Blockscout or Etherscan, the
+wallet reads that service's setting from storage. It reads it again when the
+answer lands. While the setting is off, no such request is made, and an answer
+that lands after it went off is dropped.
 
 Contacted by default:
 

src/shared/storedSettings.js

@@ -1,11 +1,11 @@
 // Reads "Use Blockscout" or "Check recipients on Etherscan" from the stored
 // profile.
 //
-// Before each request to Blockscout or Etherscan, the wallet reads its setting
-// from storage. The wallet reads the setting again when the answer lands. While
-// the setting is off, nothing is asked, and an answer that lands is dropped. A
-// page's own copy of the setting is not used, because another page may have
-// just changed it.
+// Before each request that sends the user's data to Blockscout or Etherscan, the
+// wallet reads that service's setting from storage. It reads it again when the
+// answer lands. While the setting is off, no such request is made, and an
+// answer that lands after it went off is dropped. A page's own copy of the
+// setting is not used, because another page may have just changed it.
 
 const { storageGet } = require("./browserApi");
 const { normalizePersisted } = require("./persistedState");

tests/blockscoutEtherscanSettings.test.js

@@ -1,7 +1,7 @@
 // Blockscout and Etherscan are sent none of the user's data until the user
 // turns them on (https://git.eeqj.de/sneak/AutistMask/issues/668). A new
 // profile has "Use Blockscout" and "Check recipients on Etherscan" both off.
-// While a setting is off, no code asks its service.
+// While a setting is off, no request sends its service the user's data.
 //
 // Only one request is made with the setting off: the check behind "Save" beside
 // the Blockscout URL in Settings. That check asks the URL only for `/stats` and
@@ -268,8 +268,8 @@ describe("where each request is made", () => {
     );
 
     describe("a balance refresh", () => {
-        // The RPC endpoint answers every balance with zero, and every other
-        // call, the ENS reverse lookup's, with no resolver.
+        // The RPC endpoint answers every balance with zero. The ENS reverse
+        // lookup makes the only other calls, and it finds no resolver.
         beforeEach(() => {
             FetchRequest.registerGetUrl(async (req) => {
                 const body = JSON.parse(Buffer.from(req.body).toString("utf8"));